The Update BureauKB5089900: Security update for SQL Server 2022, CU branch, May 2026. Database Engine RCE addressed; provider-string linked queries fail
Addresses one Important SQL Server vulnerability, CVE-2026-40370. Linked-server queries using MSDASQL and a provider string can fail with error 7416.
Does it affect you? Applies to: Supported x64-based SQL Server 2022 instances running SQL Server 2022 or a SQL Server 2022 CU through CU24 GDR.
Review notes Additional details from the official release notes (1) Read note
- This page CVE-2026-40370 is identified as a SQL Server Remote Code Execution vulnerability. The official page does not specify the affected SQL Server component.
The official sources are linked at the end of the page.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fix 1 change
Integration Service
-
The Web Service Task fix addresses a flaw that could let an attacker read files on the server or make it unavailable.1
Addresses an XML external entity (XXE) vulnerability in the Web Service Task that could enable arbitrary local file reads or a denial-of-service (DoS) attack. Platform: Windows.
Known issues
-
Linked server queries that use MSDASQL fail with error 7416
Linked-server queries that use the MSDASQL provider and specify a provider string can fail with error 7416: access to the remote server is denied because no login mapping exists. Stricter Database Engine connection validation can reject configurations that worked on earlier builds.2
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-05-12
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5083252, KB5080999, KB5077464, KB5078297
- Replaced by
- KB5101347
| Version | Build | Channel |
|---|---|---|
| 2022 | 16.0.4252.3 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
SQL Server Remote Code Execution Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Updated components
145 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| SQL Server Engine | 114 |
| SQL Server PolyBase | 3 |
Sources
Cited passages from Microsoft's official notes (2)
-
1.
This fix addresses an XML external entity (XXE) vulnerability in the Web Service Task that allows an attacker to read arbitrary files from the local file system or cause a denial-of-service (DoS) attack.
support.microsoft.com -
2.
Linked server queries that use the
support.microsoft.comMSDASQL(OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake